infokek

Threat Detection Specialist

[infokek @infok3k]

Seems to be interesting malware component (Blyat Fetcher)😃
https://t.co/AqeVclvJqU
https://t.co/D4MPKRLB15
#blyatfetcher #malware #sample

[infokek @infok3k]

@500mk500 @maltrail Thanks a lot!🔥

[infokek @infok3k]

@maltrail found tdesktop[.]telega[.]one resolve as malicious.
- https://t.co/4Y6HvO97si - R-Vision page about Telegram Desktop app, information about this domain as legitimate.
- https://t.co/obPmck37Cj
Maybe false-positive?

[Kseniia \n @naumovax]

🔥 New open-source #Suricata rules 🔥
https://t.co/oELvuKfAoP
For over a year now I’ve been sharing interesting #malware findings in network traffic here!
Today I want to share our project PT Rules🎉

(there are many rules written for the threats I indicated in my tweets below⬇️)

[infokek @infok3k]

Indicators of Compromise:
https://t.co/keys3svbQ7
MD5: 0e1284b0e1eb02a12618226097738e9f
C&C: theradio[.]duckdns[.]org

[infokek @infok3k]

🇧🇷 Malware that targets @sbcbrasil visitors. Simple Powershell backdoor packed via WinRAR SFX archive. Payload source code: https://t.co/WLk2QJtNKw.
After execution opens SBC picture to distract user.
#SBC #Brazil #malware #backdoor

[infokek @infok3k]

Honeypot project: https://t.co/RalDnW2T2v
#activemq #cve_2023_46604 #cve202346604 #honeypot

[infokek @infok3k]

🍯Now data from my deployed honeypots has reports on #virustotal.
https://t.co/bBJPm2mlW9
https://t.co/yr9l8B9Dxw
https://t.co/gdT9knVYfM

#malware #threatintelligence #honeypot

[infokek @infok3k]

@naumovax Interesting and useful 👍

[infokek @infok3k]

Some #HomuWitch samples:
https://t.co/BM4K96UrWm
https://t.co/30cDBAy77d
https://t.co/28S6DOxDsR
https://t.co/oL8Q0knG7X
https://t.co/GZOQkrjg89
https://t.co/X3gAiE8XG4

[infokek @infok3k]

🔓 After some days brought idea to life.

Created #HomuWitch Ransomware #decryptor.
You can easily decrypt this #ransomware using this tool.
Used C#, .NET, VS, ICSharpCode library, some time and some coffee to do it.
https://t.co/qfjqxxc3iW

[infokek @infok3k]

md5: 1332d7f5abe320bcb7bd960b2afa65b0
C&C: kazybot[.]besaba[.]com
Thanks @vxunderground.

[infokek @infok3k]

Found old #kazy #botnet with simple #cryptor (TripleDES and gzip). Encryption key and IV with malware payload stored in .NET resources. Can be easily decrypted using CyberChef 😎. Also there is builder sample in vx-underground awesome builders collection 💪.

[infokek @infok3k]

🍯Tsunami Botnet was caught using my activemq-honeypot (CVE-2023-46604).

Honeypot: https://t.co/RalDnW2T2v
Triage Sandbox: https://t.co/mdJ70ClM0y
C&C: 138[.]197.78[.]18
Page: https://t.co/9skCVntAIX

#tsunami #botnet #malware #honeypot #activemq